From: Jason Ish <ish@unx.ca>
Date: Mon, 11 Dec 2017 21:50:30 +0000 (-0600)
Subject: eve: dns: global metadata config
X-Git-Tag: suricata-4.1.0-beta1~259
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=23bbbc5818649dc20e7a69e585a27a6552bfbbbf;p=thirdparty%2Fsuricata.git

eve: dns: global metadata config
---

diff --git a/src/output-json-dns.c b/src/output-json-dns.c
index b6fea54a94..4ec5d8588b 100644
--- a/src/output-json-dns.c
+++ b/src/output-json-dns.c
@@ -254,6 +254,7 @@ static struct {
 typedef struct LogDnsFileCtx_ {
     LogFileCtx *file_ctx;
     uint64_t flags; /** Store mode */
+    bool include_metadata;
 } LogDnsFileCtx;
 
 typedef struct LogDnsLogThread_ {
@@ -666,6 +667,9 @@ static int JsonDnsLoggerToServer(ThreadVars *tv, void *thread_data,
         if (unlikely(js == NULL)) {
             return TM_ECODE_OK;
         }
+        if (dnslog_ctx->include_metadata) {
+            JsonAddMetadata(p, f, js);
+        }
         json_t *dns = rs_dns_log_json_query(txptr, i, td->dnslog_ctx->flags);
         if (unlikely(dns == NULL)) {
             json_decref(js);
@@ -683,6 +687,9 @@ static int JsonDnsLoggerToServer(ThreadVars *tv, void *thread_data,
         js = CreateJSONHeader((Packet *)p, 1, "dns");
         if (unlikely(js == NULL))
             return TM_ECODE_OK;
+        if (dnslog_ctx->include_metadata) {
+            JsonAddMetadata(p, f, js);
+        }
 
         LogQuery(td, js, tx, tx_id, query);
 
@@ -708,6 +715,10 @@ static int JsonDnsLoggerToClient(ThreadVars *tv, void *thread_data,
 
     js = CreateJSONHeader((Packet *)p, 0, "dns");
 
+    if (dnslog_ctx->include_metadata) {
+        JsonAddMetadata(p, f, js);
+    }
+
 #if HAVE_RUST
     /* Log answers. */
     for (uint16_t i = 0; i < 0xffff; i++) {
@@ -863,6 +874,7 @@ static OutputInitResult JsonDnsLogInitCtxSub(ConfNode *conf, OutputCtx *parent_c
     memset(dnslog_ctx, 0x00, sizeof(LogDnsFileCtx));
 
     dnslog_ctx->file_ctx = ojc->file_ctx;
+    dnslog_ctx->include_metadata = ojc->include_metadata;
 
     OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
     if (unlikely(output_ctx == NULL)) {